Who Is Minding the Keys?

So who holds the keys to your facilities? Are you sure about that? The fact of the matter is you may have the best laid plans for your access control and key control, but your employees may not be following your plan.

Key Control

There are plenty of examples of places that have literally no controls in place to manager their keys. On more than one occasion we have found that key control has been lax, to the point in some organizations that non-employees have keys to the facility.

For example:

• At one university campus it was found that a security officer asked a friend to work in his place and in turn so gave his untrained friend, who was not a security officer, the keys to the entire facility for a weekend.
• At a medical center master keys were passed out to anyone, including delivery drivers, newspaper boys, and many others that asked for one.
• Several companies have authorized every employee to receive a master key.

Electronic Access Control

Electronic access control systems are not much better. In fact one hospital found that their systems integrator gave their staff full unrestricted access to all areas of the hospital including administration, the pharmacy and morgue. The contractor had no need to get into any of these areas and the security department was unaware of the access rights.

Hospitality Key Control

The Chicago Tribune recently reported that a pregnant woman staying at a motel was assaulted by a person who had requested and received a key to the room at the front desk. The assailant claimed to be a related to the registered guest and the staff apparently made no attempt to verify that.

If you think that these types of incidents could not happen at your facility we hope you are right. However, we have personally watched hotel desk staff make replacement key cards without asking for identification.

Understand Your Risks

Do you know your risks with regards to your access control? When is the last time an independent security expert audited your key control or access control system? Do you know here all of your keys are at? If you do not know the answers to these basic questions it is well past time to conduct your due diligence, because plausible deniability is not a defense.